Summer School Privacy Notice

Who is collecting the information?

Edinburgh College is the Data Controller. We have an appointed Data Protection Officer (DPO), who can be contacted by emailing: DataProtection@edinburghcollege.ac.uk.

Why are we collecting it, and what are we doing with it (Purpose)?

We collect your information for the purpose of processing your application and enrolling you on the Edinburgh College Summer School; to provide any additional services you have requested; and to facilitate your studies at the college (we explain this in more detail below).

We use your information to provide you with accommodation services, cultural activities (e.g. to arrange visits to local attractions), and transport services (e.g. collecting you from the airport).

We specifically need your information:

To process your application to study at Summer School

This will include evaluating whether the college can offer you a place on a course and on what terms; contacting you about any gaps in your application or queries you have; and, where appropriate, offering you a place on an Edinburgh College Summer School course.

To review any additional support needs you may have

The application form allows you to tell the college about any additional support needs (including health needs) you may have.

For academic purposes (once you enrol)

To provide you with teaching, learning and support services; to place you in a class of the appropriate level; to assess your work, record your progress and provide you with a course completion certificate; to give you access to learning and teaching tools, IT, library, and other college services; to provide you with additional services you have requested such as accommodation, cultural activities or transport services; to seek your feedback on our courses.

For administrative and financial management services

To administer fees due and paid for by you and to process payments made for other college-related services (for example, if you are staying in college accommodation or have purchased an additional service such as airport transfers, catering, or social programme). Edinburgh College works with Western Union to facilitate student payments. When you make your payment via Western Union, Western Union will inform the College of your name, your student reference number (from the offer letter sent to you by the College) and the amount you have paid.

For immigration purposes

To support you with your application for a visa to study in the UK, and to comply with our Tier 4 Sponsor obligations to support immigration control.

For communication purposes

To communicate with you about the provision of the course you have applied for or enrolled on, and to inform you of future classes you may be interested in.

To analyse student applications and enrolments for business, planning and equal opportunities purposes

The college analyses student applications and enrolments, including by key protected characteristic groups (including age, disability, marriage and civil partnership, and gender), to plan and improve its services and curriculum offering. Analysing applications and enrolments by key protected characteristic groups forms part of the college’s responsibilities under the Public Sector Equality Duty, part of the Equality Act (2010).

To provide you with further information on courses relevant to your studies

But only where you provide consent to receive direct marketing.

What personal data do we collect?

Personal data

Name, address, telephone number, email address
Date of birth
Nationality
Next of kin and emergency contact details
Parent/Guardian details (if under 18)
Local address and personal details of the responsible adult in Edinburgh (if under 18)
Bank account details
Desired course and level of study at Edinburgh College Summer School
Financial information (including family) (only where this information is required for visa purposes)
Disciplinary information
Appeals and complaints information
Photographic image and footage (CCTV)
Your unique student ID
First/preferred language
English level
Gender
Marital/civil partnership status (*if your visa status is dependent on your partner)
Passport number and country of domicile
Visa information (including details of the relevant person if in possession of a dependent visa)

Special Category Personal Data

Disability and health data (including mental health)
Special interest group status (e.g. asylum seeker; refugee)
Attendance data (including sickness absence)
Gender identity

The lawful basis for the processing

Under GDPR Article 6(1)(b), “Processing is necessary for the performance of a contract to which the data subject is a party to take steps at the request of the data subject before entering into a contract.” It is the legal basis for processing your personal data (to enrol you as a student at Edinburgh College and deliver the educational experience detailed to you).

For special category (sensitive) personal data, the legal basis is Article 9(2)(b) “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.” The specific social protection law which authorises the processing of special category personal data is the Equality Act (2010).

Where the college provides you with further information on other courses relevant to your studies (for marketing purposes), the condition for processing your personal data is Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.

If you wish to withdraw your consent to receive direct marketing from Edinburgh College (at any time), please email: summerschool@edinburghcollege.ac.uk

Who we share the information with

For immigration purposes

As a Tier 4 Sponsor, Edinburgh College has a responsibility to comply with all aspects of the Immigration Rules and sponsor guidance, and support immigration control, including taking steps to ensure that every student at our institution has permission to study in the UK throughout the whole period of their study. We must co-operate with the Home Office (UK Visas and Immigration) by complying with requests for information, including in connection with the prevention or detection of crime, the administration of civil penalties for illegal working, and/or the apprehension or prosecution of immigration offenders.

For sponsored programmes

We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare.

For students under 18

We may contact your parents or guardians if we have any concerns about your attendance, progress or welfare.

Where we place you in accommodation (e.g. halls of residence with a homestay host):

(e.g. halls of residence with a homestay host) We will share your personal information (name, age, gender, contact details, special category information, dietary requirements, allergies, and medical requirements) to facilitate your stay.

Where we arrange transport

(e.g. taxi transfers) We will share your name and (homestay) address in Edinburgh with the transport provider.

Where we arrange bus passes

We will share your name, date of birth and ID photo with the transport provider.

Where you are due a refund of fees

If you have paid your fees through Western Union and are due a refund under our refund policy, we will share your name, reference number, email address, and the amount to be refunded with Western Union.

Where we have a legal obligation to do so

Edinburgh College is obliged to share limited information on international students with the Scottish Funding Council – the regulatory body for Scottish colleges. This information is limited to your: gender; name; date of birth; postcode; how your place on an Edinburgh College course is being funded.

Data Processors

The college uses the following data processor to process your personal information:

Unit-E is provided by a third-party supplier to process student applications. Edinburgh College hosts this software and sits within the college’s technical controls.

Details of data transfers to any third countries or international organisations

For sponsored programmes

We may be required to provide reports to your financial sponsors to update them about your attendance, progress and welfare – subject to where your sponsor is located, this may be outside the EU. Where a sponsor is outside the EU, the college ensures appropriate organisational and technical security measures are in place to safeguard your data and that an explicit agreement is in place around the security of your information.

Where you pay your fee via Western Union

Edinburgh College works with Western Union to facilitate student payments. When you make your payment via Western Union, Western Union will inform the College of your name, your student reference number (from the offer letter sent to you by the College) and the amount you have paid. Western Union processes your data in the United States. Where Edinburgh College shares your data with Western Union (for the purposes of processing a refund), your personal data will be processed in the United States.

How long do we hold the personal data?

We will keep paper records in relation to your studies for three years after the end of the academic year in which you are studying. Digital information will be held on the college’s systems and student records database to satisfy audit requirements; for example, the SFC requires Edinburgh College to retain your data for 6 years for audit purposes.

Individuals’ rights in relation to this processing

Under data protection law, you have a number of rights; some of these rights only apply if certain conditions are met. Your rights are: right to be informed (e.g. privacy notice), right of access, right of rectification, right of erasure (commonly known as the right to be forgotten), right to restrict processing, right to object, right to data portability and the right to know of any automated decision making (including profiling). It’s worth noting that you can exercise your rights either verbally or in writing, and the College would be required to process your request within one month.

The rights that apply to this particular processing are:

Right to be Informed – i.e. a privacy notice.
Right of Access – this means you have the right to access your personal information.
Right to Rectification – this means you have the right to correct inaccurate or incomplete personal information.
Right to Erasure – commonly known as the Right to be Forgotten (RTBF) – this means you can request that your personal data be deleted.
Right to Data Portability – this means you have the right to request your information in a machine-readable format (e.g. a .csv file) to be provided to you or transferred in that format to another organisation.
Right to Restriction – this means you can restrict the processing of your information and links with some of the other rights.
Right to Object – this means you can object to how your data is used.
Right to be informed of automated individual decision-making (including profiling) – we do not use this for OH purposes, and therefore this does not apply.

Some of the rights above have caveats and only apply in certain circumstances. You can exercise your rights at any time, and the College would be required to answer within a month upon receipt of your request. If you wish to exercise your rights or have any queries in relation to this, please contact the Data Protection Team at DataProtection@edinburghcollege.ac.uk.

Complaints to the UK Information Commissioner’s Office (ICO)

If you are concerned about how your personal data is being used by the College, in the first instance, please contact the College Data Protection Officer (DPO) at DataProtection@edinburghcollege.ac.uk. If you are not satisfied with the outcome, then you can complain to the regulator of data protection, the UK Information Commissioner’s Office (ICO). The ICO guides on the ICO website.

You can email them at casework@ico.org.uk, call them on 0303-123-113, or you can send a letter to them at the following address:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF